| 查看: 368 | 回复: 0 | |||
| 当前主题已经存档。 | |||
sdlj8051金虫 (著名写手)
|
[交流]
[zt]hying变形壳脱壳过程
|
||
|
????????? ??OD????????OD?????bp VirtualAlloc?????г???????? 77E64DB9 > 55 PUSH EBP///??????????? 77E64DBA 8BEC MOV EBP,ESP 77E64DBC FF75 14 PUSH DWORD PTR SS:[EBP+14] 77E64DBF FF75 10 PUSH DWORD PTR SS:[EBP+10] 77E64DC2 FF75 0C PUSH DWORD PTR SS:[EBP+C] 77E64DC5 FF75 08 PUSH DWORD PTR SS:[EBP+8] 77E64DC8 6A FF PUSH -1 ?????????? 0006FFB0 010102F3 ???????? SEH ??? 0006FFB4 00000000 SE ??? 0006FFB8 00004255 |Size = 4255 (16981.)///???????С?? 0006FFBC 00001000 |AllocationType = MEM_COMMIT 0006FFC0 00000004 \Protect = PAGE_READWRITE 0006FFC4 77E71AF6 ????? KERNEL32.77E71AF6 ALT+F9????? 010102F3 /74 08 JE SHORT notepad.010102FD///????????????EAX=00280000 010102F5 |75 06 JNZ SHORT notepad.010102FD 010102F7 |9A 00E03D00 E85>CALL FAR 50E8:003DE000 ; ?????? 010102FE 76 07 JBE SHORT notepad.01010307 01010300 77 05 JA SHORT notepad.01010307 01010302 E7 BB OUT 0BB,EAX ; I/O ???? ?????EAX=00280000???????????????????????00280000????С?4255H???????????????????????????????DUMP????????????????????? 0101052D 33C9 XOR ECX,ECX 0101052F 41 INC ECX 01010530 E8 EEFFFFFF CALL notepad.01010523 01010535 13C9 ADC ECX,ECX 01010537 E8 E7FFFFFF CALL notepad.01010523 0101053C ^ 72 F2 JB SHORT notepad.01010530 0101053E C3 RETN 0101053F 2B7C24 28 SUB EDI,DWORD PTR SS:[ESP+28] 01010543 897C24 1C MOV DWORD PTR SS:[ESP+1C],EDI 01010547 61 POPAD 01010548 C2 0800 RETN 8////?????????? 0101054B 2800 SUB BYTE PTR DS:[EAX],AL 0101054D 0000 ADD BYTE PTR DS:[EAX],AL 0101054F 1000 ADC BYTE PTR DS:[EAX],AL ??01010548????2?κ???????????002823D4??????????????F8????? 002823D4 8B0C2B MOV ECX,DWORD PTR DS:[EBX+EBP]////???????? 002823D7 56 PUSH ESI 002823D8 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[> 002823DA 5E POP ESI 002823DB 53 PUSH EBX 002823DC 68 00800000 PUSH 8000 002823E1 6A 00 PUSH 0 002823E3 56 PUSH ESI 002823E4 FF95 A8090000 CALL NEAR DWORD PTR SS:[EBP+9A8] 002823EA 5B POP EBX 002823EB 83C3 0C ADD EBX,0C ??????????????? 00282551 /75 0A JNZ SHORT 0028255D 00282553 |8B52 04 MOV EDX,DWORD PTR DS:[EDX+4] 00282556 |C742 50 0010000>MOV DWORD PTR DS:[EDX+50],1000 0028255D \89AD 17090000 MOV DWORD PTR SS:[EBP+917],EBP 00282563 8B85 87090000 MOV EAX,DWORD PTR SS:[EBP+987] 00282569 0385 73090000 ADD EAX,DWORD PTR SS:[EBP+973] 0028256F - FFE0 JMP NEAR EAX ////??????????F4??????????????EAX=01006420????????????? 00282571 50 PUSH EAX 00282572 8BC4 MOV EAX,ESP 00282574 60 PUSHAD 00282575 8BD8 MOV EBX,EAX 00282577 E8 04000000 CALL 00282580 0028257C 65:1C 28 SBB AL,28 ; ??????? 0028257F 005D 8B ADD BYTE PTR SS:[EBP-75],BL F7?????? 01006420 55 PUSH EBP////???? 01006421 8BEC MOV EBP,ESP 01006423 6A FF PUSH -1 01006425 68 88180001 PUSH notepad.01001888 0100642A 68 D0650001 PUSH notepad.010065D0 0100642F 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] 01006435 50 PUSH EAX 01006436 64:8925 0000000>MOV DWORD PTR FS:[0],ESP 0100643D 83C4 98 ADD ESP,-68 01006440 53 PUSH EBX 01006441 56 PUSH ESI 01006442 57 PUSH EDI 01006443 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP 01006446 C745 FC 0000000>MOV DWORD PTR SS:[EBP-4],0 0100644D 6A 02 PUSH 2 0100644F 90 NOP 01006450 E8 1CC127FF CALL 00282571 01006455 83C4 04 ADD ESP,4 01006458 C705 38990001 F>MOV DWORD PTR DS:[1009938],-1 01006462 C705 3C990001 F>MOV DWORD PTR DS:[100993C],-1 0100646C 90 NOP 0100646D E8 FFC027FF CALL 00282571 01006472 8B0D 44880001 MOV ECX,DWORD PTR DS:[1008844] 01006478 8908 MOV DWORD PTR DS:[EAX],ECX 0100647A 90 NOP 0100647B E8 F1C027FF CALL 00282571 01006480 8B15 40880001 MOV EDX,DWORD PTR DS:[1008840] 01006486 8910 MOV DWORD PTR DS:[EAX],EDX 01006488 A1 54110001 MOV EAX,DWORD PTR DS:[1001154] 0100648D 8B08 MOV ECX,DWORD PTR DS:[EAX] ???????????????CALL 00282571??????䶮???????????00282571????е?????????????????IAT?? ????????IAT?? ????01006450 ????CALL 00282571?? 00282571 50 PUSH EAX 00282572 8BC4 MOV EAX,ESP 00282574 60 PUSHAD 00282575 8BD8 MOV EBX,EAX 00282577 E8 04000000 CALL 00282580 0028257C 65:1C 28 SBB AL,28 ; ??????? 0028257F 005D 8B ADD BYTE PTR SS:[EBP-75],BL 00282582 6D INS DWORD PTR ES:[EDI],DX ; I/O ???? 00282583 008B 7B048BB5 ADD BYTE PTR DS:[EBX+B58B047B],CL 00282589 8309 00 OR DWORD PTR DS:[ECX],0 0028258C 0003 ADD BYTE PTR DS:[EBX],AL 0028258E F5 CMC 0028258F 8B06 MOV EAX,DWORD PTR DS:[ESI] 00282591 33D2 XOR EDX,EDX 00282593 B9 02000000 MOV ECX,2 00282598 F7E1 MUL ECX 0028259A D1E8 SHR EAX,1 0028259C 3BF8 CMP EDI,EAX 0028259E 75 0A JNZ SHORT 002825AA 002825A0 0AD2 OR DL,DL 002825A2 75 04 JNZ SHORT 002825A8 002825A4 EB 09 JMP SHORT 002825AF 002825A6 EB 02 JMP SHORT 002825AA 002825A8 EB 10 JMP SHORT 002825BA 002825AA 83C6 08 ADD ESI,8 002825AD ^ EB E0 JMP SHORT 0028258F 002825AF 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 002825B2 8903 MOV DWORD PTR DS:[EBX],EAX 002825B4 61 POPAD 002825B5 58 POP EAX 002825B6 8B00 MOV EAX,DWORD PTR DS:[EAX]////F4?????? 002825B8 FFE0 JMP NEAR EAX////???????! 002825BA 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 002825BD 8903 MOV DWORD PTR DS:[EBX],EAX 002825BF 61 POPAD 002825C0 58 POP EAX 002825C1 83C4 04 ADD ESP,4 002825C4 8B00 MOV EAX,DWORD PTR DS:[EAX] F4??002825B6??????????????? DS:[01001160]=7800776E (msvcrt.__set_app_type) EAX=01001160 (notepad.01001160), ASCII "nw" ????01001160????????????01001160???????? 01001158 C9 1E 00 78 D7 7F 00 78 ?.x?.x 01001160 6E 77 00 78 20 A0 03 78 nw.x ?x 01001168 53 7C 00 78 3E C0 00 78 S|.x>?x 01001170 DA 7C 00 78 6A BD 00 78 ?|.xj?x ??????????????????????? 01001000 BC C7 6E 79 7D 2A 6D 79 ??ny}*my 01001008 DB 1D 6D 79 8D 2B 6D 79 ?my?my 01001010 B9 24 6D 79 9C 2C 6D 79 ?my?my 01001018 BF 18 6D 79 00 00 00 00 ?my.... ???????????? 010012D8 9B ED AF 76 3F ED AF 76 ???v???v 010012E0 3C E8 B0 76 7C 55 B0 76 010012E8 E2 16 AF 76 BD 5A B0 76 ??v?Z?v 010012F0 7A 98 B0 76 E8 DF AF 76 z??v??v 010012F8 00 00 00 00 00 00 00 00 ........ ???IAT??01001000??010012F7????????С?2F8?? ??????????????????μ???IAT?????????????????OD????DUMP??01006450????4?????????????????F9????????? 002823D8 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]////???????? 002823DA 5E POP ESI 002823DB 53 PUSH EBX 002823DC 68 00800000 PUSH 8000 002823E1 6A 00 PUSH 0 002823E3 56 PUSH ESI 002823E4 FF95 A8090000 CALL NEAR DWORD PTR SS:[EBP+9A8] ???01006450????δ????????F9?????????? 00282515 25 FFFFFF7F AND EAX,7FFFFFFF 0028251A 8BDE MOV EBX,ESI 0028251C 2BD8 SUB EBX,EAX 0028251E 8958 FC MOV DWORD PTR DS:[EAX-4],EBX////???????? 00282521 83C7 08 ADD EDI,8 00282524 ^ EB E7 JMP SHORT 0028250D 00282526 64:FF35 3000000>PUSH DWORD PTR FS:[30] 0028252D 58 POP EAX 0028252E 85C0 TEST EAX,EAX 00282530 78 0F JS SHORT 00282541 00282532 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] 00282535 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] ?????EBX=FF27C11C EAX=01006455 ???????????????????????????????????????????ǹ??????! ??????? 0028250D 8B07 MOV EAX,DWORD PTR DS:[EDI] ////????????EAX?????EDI=28370D?? 0028250F 0BC0 OR EAX,EAX 00282511 75 02 JNZ SHORT 00282515 00282513 EB 11 JMP SHORT 00282526 00282515 25 FFFFFF7F AND EAX,7FFFFFFF 0028251A 8BDE MOV EBX,ESI 0028251C 2BD8 SUB EBX,EAX 0028251E 8958 FC MOV DWORD PTR DS:[EAX-4],EBX 00282521 83C7 08 ADD EDI,8 00282524 ^ EB E7 JMP SHORT 0028250D////????????? 00282526 64:FF35 3000000>PUSH DWORD PTR FS:[30] ??DUMP??28370D???????? 00283705 55 64 00 01 60 11 00 01 Ud.`. 0028370D 80 65 00 01 68 11 00 01 ?e.h. 00283715 DC 65 00 81 6C 11 00 01 ?e.?l. ??????????????????????????[EDI+4]??????????????????? ?????????????? 00283675 F0 30 00 81 D4 12 00 01 ?.??. 0028367D EA 30 00 81 D8 12 00 01 ?.??. 00283685 E4 30 00 81 DC 12 00 01 ?.??. 0028368D 3C 66 00 81 E0 12 00 01 ???????????? 0028422D 3C 57 00 01 BC 12 00 01 0028423D 4E 66 00 81 C8 12 00 01 Nf.??. 00284245 42 66 00 81 CC 12 00 01 Bf.??. ??????PATH?? ???????????????OD?????bp VirtualAlloc??????????F4??01010548?? CTRL+G?????? 00282515 25 FFFFFF7F AND EAX,7FFFFFFF////???????PATH?? 0028251A 8BDE MOV EBX,ESI 0028251C 2BD8 SUB EBX,EAX 0028251E 8958 FC MOV DWORD PTR DS:[EAX-4],EBX 00282521 83C7 08 ADD EDI,8 00282524 ^ EB E7 JMP SHORT 0028250D 00282526 64:FF35 30000000 PUSH DWORD PTR FS:[30] ?????? 00282515 /E9 E6280000 JMP 00284E00 Path???? 00284E00 807F 03 01 CMP BYTE PTR DS:[EDI+3],1////??????λ????1?? 00284E04 75 11 JNZ SHORT 00284E17 00284E06 8B5F 04 MOV EBX,DWORD PTR DS:[EDI+4]////??????????????????EBX?? 00284E09 66:C740 FA FF15 MOV WORD PTR DS:[EAX-6],15FF////???????CALL[XXXXXXXX] 00284E0F 8958 FC MOV DWORD PTR DS:[EAX-4],EBX 00284E12 ^ E9 0AD7FFFF JMP 00282521////????????? 00284E17 25 FFFFFF7F AND EAX,7FFFFFFF////??????λ?? 00284E1C 8B5F 04 MOV EBX,DWORD PTR DS:[EDI+4] 00284E1F 66:C740 FA FF25 MOV WORD PTR DS:[EAX-6],25FF////???????JMP[XXXXXXXX] 00284E25 8958 FC MOV DWORD PTR DS:[EAX-4],EBX 00284E28 ^ E9 F4D6FFFF JMP 00282521////????????? 00284E2D 90 NOP ?????????IAT??????λ??81??01??????forgot???????81???????25FF???????01???15FF????????forgot????????????????????????????forgot??????????? ??????????PATH??????????DUMP????????ImportREC?????OK??? -------------------------------------------------------------------------------- [ Last edited by sdlj8051 on 2006-10-6 at 11:27 ] |
回复此楼» 猜你喜欢
基金申报
已经有5人回复
-
基金委咋了？2026年的指南还没有出来？
已经有7人回复
-
国自然申请面上模板最新2026版出了吗？
已经有17人回复
-
纳米粒子粒径的测量
已经有8人回复
-
疑惑？
已经有5人回复
-
计算机、0854电子信息（085401-058412）调剂
已经有5人回复
-
Materials Today Chemistry审稿周期
已经有5人回复
-
溴的反应液脱色
已经有7人回复
-
推荐一本书
已经有12人回复
-
常年博士招收(双一流，工科)
已经有4人回复